Method of and system for encryption and authentication

ABSTRACT

The invention provides a method of and system for networked security, involving multiple clients and servers. Rather than relying on single server based authentication and/or single stream based data transmission, the invention breaks apart information before if leaves the User&#39;s computer so that intercepting any single electronic message does not provide the hacker with sufficient information to gain access. The invention splits the values (i.e. password, User name, card number for authorization; encrypted text for encryption, etc.) at the point of sender/external authorization client. These split values are encrypted with different keys and transmitted to multiple external authorization servers. The invention can be applied to any secure transmission, storage or authentication of data over a data network.

FIELD OF INVENTION

The present invention relates generally to telecommunications, and morespecifically, to a method of and system for electronic encryption,authentication and security over networked systems.

BACKGROUND OF THE INVENTION

Computer and telecommunications systems are almost pervasive in theindustrialized world today. Many of these systems provide access topersonal and/or commercial data, services and resources that must bekept secure, limiting access to those individuals and devices withproper authorization. This is a major challenge. Unauthorized access isknown to occur on a regular basis to some of the most heavily guardedcomputer systems and local networks on the planet, including forexample, servers in the Pentagon.

Almost all existing authorization processes employ a model wherein Userscommunicate their access information in the form of single electronicmessages to single servers. An exemplary block diagram of such a systemis shown in FIG. 1.

In the course of the login process, a prospective User 12 will send asingle electronic message containing, for example, a User ID(identification) and password. This single electronic message isreceived by the single server 14 over the network 16 (which may be alocal Ethernet, wide area network, telecommunications network, Internet;wireless, hard wired or fiber optic network; or any combination of theseor similar networks) and it determines whether the submitted datacorrelates with a stored, authorized User ID and hashed password 18. Ifthe User ID and password are valid then access to the secure resources20 is allowed, while if the information is invalid, access is denied.

This existing authorization process is highly and increasinglyvulnerable to hacking (i.e. unauthorized entry) into servers that oftencarry private, valuable and confidential information. The above processis highly vulnerable because a hacker 22 (i.e. an individual or computerattempting to obtain unauthorized entry) is often able to intercept thesingle electronic message containing the User's ID and password, andthereby obtain all necessary information to gain access. Hackers arealso able to trick single servers into believing they are an authorizedUser by exploiting known weaknesses or gaining back door entry.

Either way, the use of a single electronic message to a single serverhas been found to be an insecure method of authentication and security.

A similar paradigm is used for encryption, where a single key or phraseis used to protect a document or dataset. Again, this is an ineffectivemethod of protection. Keys and phrases that are too short are easilydiscovered simply by guesswork. Keys that are long are generally storedelectronically, and thus are vulnerable to being found or intercepted.Accordingly, the use of a single key or phrase stored in a singlelocation has also been found to be an ineffective model for encryption.

There is therefore a need for a method of and system for electronicencryption, authentication and security over networked systems, whichaddresses the problems outlined above.

SUMMARY OF THE INVENTION

It is therefore an object of the invention to provide a method of andsystem for electronic encryption, authentication and security overnetworked systems, which obviates or mitigates at least one of thedisadvantages described above.

An authorization and encryption process has been developed that may bedescribed as Multi-Homed Protection (MHP). MHP splits data values beingprotected (for example a password, User name, card number forauthorization, encrypted text for encryption, or other data) at thepoint of the sender or external authorization client 30, as shown in theprocess flow diagram of FIG. 2.

For authorization processes, these split values are encrypted withdifferent keys and transmitted to multiple external authorizationservers 32, 34 (two are shown, but many more could be used). Theseexternal authorization servers 32, 34 verify the username, password,etc. at different servers by comparing submitted data with storedtables. Each external authorization server 32, 34 then provides anauthorization ID to the protected authorization server 36. The total ofall multiple authorization IDs are required to match. Provided all IDsmatch, a validation key is then returned to each of the issuing externalauthorization servers, thus signifying valid authorization.

This technology introduces and provides an exponential increase incomplexity and security for systemic authorization processes. Because ofthe difficulty in intercepting every partial set of valuessimultaneously, it carries the potential to minimize occurrences ofhacking to the point where almost all hacking that occurs is due tohuman error (for example, the Client leaving his password written downat his desk, or falling victim to a “shoulder-surfing” attack by aco-worker).

Similar to the authorization process, the multi-homed encryption (MHE)process splits encrypted values at the point of sending, transmittingeach encrypted part to different external servers. These parts are thenrelayed to the recipient, where the whole set of encrypted values isconsequently reassembled.

This technology makes it virtually impossible to intercept the entireset of transmitted encrypted values/text. Because of the difficulty inintercepting every partial set of values simultaneously, this technologyresults in an exponential improvement in the degree of protection forthe encryption process.

One aspect of the invention is defined as a method of securedcommunication over a networked system comprising the steps of: a firstparty: splitting a secure message into two or more separate messages,each separate message including at least some unique portion of thesecure data message, and all of the two or more separate messagescollectively preserving all of the information contained in the securemessage; and transmitting each of the two or more separate messages to aseparate gatekeeper. Each of the separate gatekeepers then receive arespective one of the separate messages; securely process the separatemessage, and transmit the processed separate message to a second party.The second party receives the processed separate messages from each ofthe separate gatekeepers; and re-assembles the processed, separatemessages.

Another aspect of the invention is defined as a system for securedcommunication comprising: a first device operable to: split a securemessage into two or more separate messages, each separate messageincluding at least some unique portion of the secure data message, andall of the two or more separate messages collectively preserving all ofthe information contained in the secure message; and transmit each ofthe two or more separate messages to a separate gatekeeper; each of theseparate gatekeepers being operable to: receive a respective one of theseparate messages; securely process the separate message, and transmitthe processed separate message to a second device; the second devicebeing operable to: receive the processed separate messages from each ofthe separate gatekeepers; and re-assemble the processed, separatemessages; the first device, second device and separate gatekeepers beinginterconnected via a communication network.

This summary of the invention does not necessarily describe all featuresof the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

These and other features of the invention will become more apparent fromthe following description in which reference is made to the appendeddrawings wherein:

FIG. 1 presents a system block diagram of a basic authentication modelas known in the art;

FIG. 2 presents a process flow diagram of an authentication model in anembodiment of the invention;

FIGS. 3A-3C present a set of system block diagrams for authentication,document transmission and document storage paradigms respectively, inembodiments of the invention; and

FIGS. 4A-4D present a set of process flow diagrams of an authenticationmodel in an embodiment of the invention.

DETAILED DESCRIPTION

A method of and system for electronic encryption, authentication andsecurity over networked systems is described, that is far more securefrom known hacking techniques than existing security processes. Whileexisting security processes typically rely on one single electronicmessage and one server, the process of the invention breaks informationapart before it leaves the User's computer or other digital device, sothat intercepting any single electronic message does not provide thehacker with sufficient information to gain access. It will send, forexample, the User identification (ID) and password to two or moreexternal servers that act as gatekeepers. The system and method of theinvention can break apart this information several times, each timeproviding an exponential increase in security.

The system and method of the invention can be implemented over any formof network, including, for example, a local Ethernet, wide area network,telecommunication network, Internet; wireless, hard wired or fiber opticnetwork; or any combination of these or similar networks. As well, theUser or client may be any electronic device capable of supporting simplecomputation, including for example a personal computer (PC), laptopcomputer, personal digital assistant (PDA), wireless email device,cellular telephone, or MP3 player. Other similar devices could also beused. Of course, the system can accommodate access to any data orcontent including, for example: music, video, web pages and email.

Each server, or gatekeeper, then communicates independently with theprotected server that holds the information or resources that are beingsecured. For each gatekeeper, there is a key where preexisting data(User ID, password, etc) must correspond to the submitted data.Ultimately, each key must grant authorization before the User gainsaccess to the protected server. This process makes it exponentially moredifficult for hackers to penetrate into protected servers than anyexisting form of authorization security.

This method and system is straightforward to implement given theteachings herein and is able to piggyback off existing softwareprograms. The ability to decentralize information introduces an entirelynew paradigm into the IT security world (from centralized, Newtoniancommunication, to decentralized, fractal communication) and gives ittremendous value, particularly in the global business, scientific anddefense communities where the level of authorization security iscurrently inadequate.

The encryption process of the invention functions under the sameprinciples as the authorization process. Basically, existing encryptiontechnology, such as PGP—the world's leader in encryption software—wrapsa single message into a complex encrypted message. A potentialinterceptor or hacker may be easily able to intercept the message.Though it is extremely difficult to decrypt the message without knowingthe key, it is not impossible—given enough time and processing power, itcan be decrypted. The invention is able to piggyback on PGP or almostany other encryption software, and the combination of the two wouldoffer an exponentially greater level of encryption security.

The encryption process works by fragmenting a message into two ormore—and potentially thousands or millions—of parts and sending theparts to the recipient via several different communication channels.Thus, if a hacker is able to intercept one message he or she will onlyhave obtained a small part of the whole message. The more parts that themessage is broken into, the more difficult it becomes for the hacker tointercept each crucial, partial message. Even if a hacker were able tointercept every one of several thousand messages—some of which could bedecoys—the hacker would then have the enormous difficulty of puttingthese pieces back together. Furthermore, each of these messages will beencrypted using a high level of existing encryption software, such asPGP which is currently one of the strongest.

The invention is not unbreakable no encryption technology is—however, itdoes provide an exponential increase in protection from existingtechnology.

The present invention will be further illustrated by means of thefollowing examples.

FIGS. 3A-3C

FIGS. 3A-3C present system block diagrams of authentication, documenttransmission and document storage paradigms respectively.

In one embodiment of the invention a message (either encrypted orplaintext) is broken into multiple parts on the User's computer 50 usinga partitioning algorithm, which may be a sliding or a non-slidingalgorithm. Note that the partitions of data can overlap one another,provided that collectively, they preserve all of the information fromthe original message. Each of these multiple parts gets transmittedindependently to a separate external server 52, and each of thoseexternal servers 52 authenticates its part of the message based onstored algorithms (thus, the external servers 52 are operating aspartial authentication servers). This can be done by storing each pieceon each external server 52 (for identity authentication) or by runningthe same algorithms on a stored firewalled version of the whole (i.e.Username and Passphrase). Though three external servers 52 are shown inFIG. 3A, there is no upper limit on the number of external servers 52that could be employed.

After the pieces have been authenticated, they are sent to a firewalledserver 54, 56 that only communicates with the individual authenticationservers 52. This firewalled server 54, 56 compares the authenticationcertificates from each authentication server 52, or in the case of anencrypted message, recombines the pieces. In the case of authentication,all of the certificates are compared and it is determined whether or notall are valid. If they are valid, each authentication server 52 is givena validity certificate from the firewalled server 54, 56, and then sendsa final validity to the client (whether that is an e-commerce enabledwebsite, a network login or any other electronic password protectionutility).

The order of the pieces to be recombined can be determined in a numberof ways. For example:

-   1. they could be ordered by their original transmission time stamps    (i.e. the time at which they left the original User);-   2. each separate piece could be given a unique number or other    identifier when the splitting is done on the User, the piece    numbering being encrypted with the balance of the data in the piece.    Numeric identifiers, of course, do not have to be in numerical    order;-   3. a “rules-based” approach could be used;-   4. a schema approach could be used; or-   5. any combination of the above. For example, timing data could be    mixed with an identifier, which indicates which rule to apply.    Other methods of determining the order of the pieces would be clear    to one skilled in the art.

The same could also be done with a non-firewalled server 54 as shown inFIG. 3B.

In the case of document storage per FIG. 3C, the document remains storedon the firewalled server 54, 56 until a request arrives, at which pointthe document is re-broken by the appropriate algorithms and sent out tothe receiving computer 50 using the same multiple server schema (thatis, sending separate pieces through multiple external servers 52). Inthe case of document transmission (i.e. e-mail transmission and thelike) per FIGS. 3B, the multiple parts are sent to the recipient whochecks the validity of each piece and then re-combines and decrypts.Multiple parts could also be stored on multiple servers and never madewhole.

The major ways in which this can address issues with existingtechnologies are as follows:

in order to duplicate the hash of a password (as noted above in theBackground to the Invention) a hacker would need to determine whichpieces of the message contain the values they need to alter and thenduplicate the hash of each of those parts. This may involve many parts;and

in the case of packet sniffing, multiple routing means that there aremultiple packet ID's comprising the same pieces of data, makingreassembly of the original transmission very difficult, as well asmaking the packet sniffer need to work on multiple machinessimultaneously and determine which packets have the same originatingsender. Even when this is completed, the hacker still needs to break thestrong encryption used.

An alternative method is to separate the message into individual bits,with a provided key that would add an additional 8 bits to each bit (inorder to determine message position) and send each bit as a separatetransmission. This is too time consuming to be practical in today'scomputing environment but may be possible in the near future. Thepreferred embodiment at the present time is to use byte-basedtransmissions with strong encryption.

If a file has been stored with multiple parts, encrypted and stored inmultiple locations, the User can allow another user to access the filein a number of ways. For example, in response to hitting a “send” optionon the User's GUI, a dialog could open asking who (on the trusted userlist) the User wants to send it the file to. Each trusted user isconfigured with an identity in the file transmission structure. The Userselects the trusted user he wishes to send the file to and if the filewas stored locally, the system would perform the encryption andsplitting routines, and send the pieces to the other user. But if thefile is already stored in multiple different places as in the case ofthis example, the system would:

-   1. send a notification to the other user that the first user is    sending a file;-   2. wait for an acceptance response from the second user;-   3. instruct the locations storing those pieces, to send them to the    other user;-   4. the pieces are then sent to the other user who receives and    decrypts them.    This assumes that either the original encryption had been done using    a key the second user has access to, or if the second user does not    have access to the key, the first user would encrypt, split and then    transmit the key.

Of course, access to such stored documents could be delegated or emailedto any other party, who does not necessarily have to be on a “trusteduser list”.

FIGS. 4A-4D

FIGS. 4A-4D present a process flow diagram of an authentication model inan embodiment of the invention.

FIG. 4A presents a process flow diagram of the authentication processfrom the point of view of the Client.

Typically, values for the User Name 70 and Passphrase 72 are enteredinteractively by the User. It is not generally desirable for the User'scomputer to store the last User Name 70 and/or Passphrase 72 as somesystems do, as it compromises security.

The User Name 70 and Passphrase 72 are then encrypted 76 on the clientusing a seed number. This seed number 74 will be generated in somemanner of generating random or pseudo-random numbers as known in theart, such as:

using a random number generating algorithm;

accessing various time signals;

accessing random data locations in memory; or

tracking the User's random cursor movements.

The encrypted username 78 and encrypted passphrase 80 are then combinedinto one large number 82 which is then separated into multiple partsusing some manner of partitioning algorithm 84. The separated values arestored in an array structure 86. The contents of the separate elementsof the array 86 are then sent to separate external servers 88 forcomparison with a data set stored on the Protected Server.

FIG. 4B presents a process flow diagram of the authentication processfrom the point of view of Firewalled Backend Server.

An encrypted User name 90 and encrypted passphrase 92 are stored in thedatabase records of the Firewalled Backend server 54, 56. In the eventof a client submitting an authentication request, the external servers100 request the stored encrypted User name 90 and encrypted passphrase92 from the Firewalled Backend server 54, 56. These encrypted User name90 and passphrase values 92 are then combined into one large number 94which is then separated into multiple parts via the splitting subroutine96. Separated values are stored in an array structure 98. The contentsof each element of the array structure 98 are sent to separate externalservers 100 for comparison with client data broadcast.

FIG. 4C presents a process flow diagram of the process of FinalAuthentication on the gateway servers.

Each gateway server 52 receives matched data sets from both the client108 and the protected server 118 (recall that the protected server 118is the server that contains the secure data and/or resources). Each dataset is a piece of the aggregate value of both the encrypted ID and theencrypted Passphrase. The partial data set 110 from the protected server118 and the partial client data set 112 are compared 124 at the gatewayserver 52. If the two data sets match 114, a positive validation code116 is generated with a transaction identification number and is thenreturned to protected server 118.

The protected server 118 then returns an authentication code to each ofthe gateway servers 52, which they receive at block 120. Thisauthentication code is split into encrypted parts 110 by the protectedserver 118 before returning to external servers 52. The external servers52 encrypt and broadcast their respective portions of the authorizationcode, returning them to the client 108 at block 122. When the partialauthorization codes are received by the client 108, they are thenrecombined into a single authentication number. This authenticationnumber would be appended specifically for any transactions within thissession. Any use of this authentication number beyond this session wouldbe considered invalid.

If data sets within each or any external server do not match, a negativecode is returned to protected server at block 126 and the authenticationcode is deemed invalid. If each data set matches within each externalserver, positive codes are returned to the protected server, and thecombined and authentication code is deemed valid.

FIG. 4D illustrates a simplified overview of the entire AuthenticationProcess.

First, the Client combines and broadcasts an encrypted data set (User IDand passphrase). The encrypted data set is combined into an aggregatevalue and then split, after which it is broadcast to external servers 52(one data set per server).

When this data is received by the external servers 52, the externalservers 52 request relevant data from the protected server 54. Eachexternal data set 138 (typ.) is compared 130 with the generated data setfrom the protected server 54. The validation state is sent to theprotected server 54, and the Protected server 54 compares all validationstates in the transaction.

In the event of positive verification of every partial data set at step132, the protected server 54 returns an (encrypted, partial)authentication code. Authentication codes are sent to the client andrecombined. If this authentication code is recombined into a validnumber, transaction proceeds (step 134). If the authorization code isrecombined into an invalid number, transaction halts (step 136).

EXAMPLE Application to an Authorization Process in an Online Music StoreCard

A User accesses an online music store to make a purchase. Afterselecting “checkout” in his online shopping cart, the User is promptedfor a User name, password and card number (the User's music card wasobtained via mail or at physical location. The User could also usecredit or debit card for the transaction). The User then enters his Username, password and card number. The User name and password are encryptedusing his card number as a seed value (further modified by the use of atime stamp), using, for example, public key based encryption such asPGP. The encrypted User name and password are joined into a singlevalue, then split into byte-sized chunks. The algorithm used to do thisis based on byte-generation via alternating bits, starting at each endof full value, the first bit being taken from the beginning of thestring, the second bit is the last bit in the string, the third bit isthe second in the string, the fourth bit is the second from last in thestring and so on for each byte.

This example provides a highly secure transaction. In practice, however,less secure methodologies may be employed, such as simple byte for bytechunking. In such a case each chunk is submitted to a separate, musicstore, external server. Each chunk is algorithmically compared to storedvalues from the music store's protected server. If they match internalvalues, a pass code is sent to the protected server. Hall values pass,the transaction is completed and an authorization stamp is encrypted,broken apart into byte-sized chunks and sent to the online music store'sseparate, external servers. Each piece of the transaction code is thensent to the User and reassembled within the User's software. If all ofthe chunks match, the User is given a transaction succeeded message and,if applicable, download of music begins.

Thus, multiple data streams are generated for a single transaction withthe added advantage of allowing some overlap in streams for enhancederror correction for cases of unencrypted data transmission. Thisprovides a greater degree of security for any network transmission.

Thus, in short:

A process has been developed that enhances the level of electronicencryption and authorization;

This process divides electronic messages into multiple parts and thenauthenticates each individual part before recombining into a coherentwhole;

With encryption, exponentially higher levels of security for both datatransmission and authentication, are provided;

Messages are algorithmically separated into parts. Each part may betransmitted to different servers;

Where each part is then authenticated;

Parts are transmitted to a firewalled server;

Parts are re-combined (or in case of authentication, individualauthentication certificates are compared);

In case of authentication, certificates are returned to eachauthenticating server. For encryption, parts are broken apart again andreturned; and

Validity certificates are returned to originating computer.

Options and Alternatives

While particular embodiments of the present invention have been shownand described, it is clear that changes and modifications may be made tosuch embodiments without departing from the true scope and spirit of theinvention. For example:

-   1. the invention could be used for encrypted file transmission such    as: high security documents, digital media files (such as movies or    music), financial transaction data, authentication codes, any    document needing absolute verifiable sources, live video    transmission (e.g. corporate digital conferences, CCTV, or    subscription or fee based broadcast), electronic voting, RFID tags    or transmission of biometric authentication date;-   2. unencrypted file transmission with enhanced error correction;-   3. automatic protection against server level viruses. This works via    checksum matching;-   4. use of multiple routing in protected server to counter DOS    attacks;-   5. network authentication for financial transactions, network logons    or similar processes;-   6. wireless Data Transmission including: Modified WEP encryption,    and Multiple broadcast point transmission;-   7. secure networked storage and retrieval of data;-   8. use of splitting via multiple processors in addition to multiple    servers. The difference is that splitting via multiple processors    applies to a single computer rather than network (at present such    applications are technically impractical);-   9. Multiple Server File Storage; it would also be possible to take a    single file and spread it byte or bit wise over multiple hard drives    residing in multiple computer systems;-   10. Multiple encryption; an alternative would be to split the    message before encryption and then encrypt using multiple schemas    for a single message or string;-   11. This technology could also be used to split a single value into    multiple locations on a single machine (e.g. multiple tables within    a single database); or-   12. This technology could be used to protect communications between    multiple computers, servers and/or networks in a symmetric    multi-processing, grid-computing or cluster-computing model along    the lines of Chaos Linux or the SETI project.

CONCLUSIONS

The present invention has been described with regard to one or moreembodiments. However, it will be apparent to persons skilled in the artthat variations and modifications can be made without departing from thetrue scope and spirit of the invention.

The method steps of the invention may be embodiment in sets ofexecutable machine code stored in a variety of formats such as objectcode or source code. Such code is described generically herein asprogramming code, or a computer program for simplification. Clearly, theexecutable machine code may be integrated with the code of otherprograms, implemented as subroutines, by external program calls or byother techniques as known in the art.

The embodiments of the invention may be executed by a computer processoror similar device programmed in the manner of method steps, or may beexecuted by an electronic system which is provided with means forexecuting these steps. Similarly, an electronic memory medium suchcomputer diskettes, CD-Roms, Random Access Memory (RAM), Read OnlyMemory (ROM) or similar computer software storage media known in theart, may be programmed to execute such method steps. As well, electronicsignals representing these method steps may also be transmitted via acommunication network.

The system and method described could, for example, be applied tocomputers, smart terminals, personal digital assistants andInternet-ready telephones. Again, such implementations would be clear toone skilled in the art, and do not take away from the invention.

All citations are hereby incorporated by reference.

1.-24. (canceled)
 25. A method of secured communication over a networkedsystem comprising: a first party: splitting a secure message into two ormore separate messages, each separate message including at least someunique portion of said secure data message, said two or more separatemessages collectively preserving information contained in said securemessage; and transmitting each of said two or more separate messages toa separate gatekeeper; each of said separate gatekeepers: receiving arespective one of said separate messages; receiving a partial data setfrom a second party; securely processing said separate message bycomparing the one of said separate messages to the partial data set;generating a pass code responsive to the comparison; and transmittingsaid processed separate message and the pass code to the second party;said second party: receiving said processed separate messages and thepass code from each of said separate gatekeepers; and re-assembling saidprocessed, separate messages.
 26. The method of claim 25 wherein saidsecure message is split using a partitioning algorithm.
 27. The methodof claim 26 wherein said partitioning algorithm comprises at least oneof: a sliding algorithm or a non-sliding algorithm.
 28. The method ofclaim 26 wherein the contents of said two or more separate messagesoverlap.
 29. The method of claim 26 wherein the contents of said two ormore separate messages do not overlap.
 30. The method of claim 25wherein said secure message comprises a request for access to data heldby said second party.
 31. The method of claim 30 wherein said requestfor access includes data selected from the group consisting of aUsername, a User ID, a password, a passphrase and a User identifier. 32.The method of claim 25 wherein said first party is selected from thegroup consisting of: a personal computer; a cellular telephone; apersonal digital assistant (PDA); a portable music player; a wirelessemail device; a portable video player; and other similar electroniccommunication device.
 33. The method of claim 25 wherein said securemessage comprises an encrypted text message, each separate message beingencrypted with a different key.
 34. The method of claim 25 wherein saidsecure message comprises an email message.
 35. The method of claim 25wherein said transmitted separate messages further comprise decoymessages.
 36. The method of claim 25 wherein said second party comprisesa secure server.
 37. The method of claim 25 wherein said second partycomprises a firewalled server which will only communicate with saidseparate gatekeepers.
 38. The method of claim 25 wherein said securemessage is of a type selected from the group consisting of: highsecurity documents; digital media files, including movies and musicfiles; financial transaction data; authentication codes; any documentneeding absolute verifiable sources; live video transmissions, includingcorporate digital conferences, CCTV, or subscription and fee basedbroadcasts; electronic voting; RFID tags; and transmission of biometricauthentication date.
 39. The method of claim 25 wherein said securedcommunication is applied to a system selected from the group consistingof: unencrypted file transmission with enhanced error correction;automatic protection against server level viruses via checksum matching;use of multiple routing in protected server to counter DOS attacks;network authentication for Financial transactions or Network logons;wireless Data Transmission for Modified WEP encryption or Multiplebroadcast point transmission; secure networked storage and retrieval ofdata; use of splitting via multiple processors in addition to multipleservers; and splitting via multiple processors applied to a singlecomputer rather than a network of computers or servers.
 40. The methodof claim 25 wherein said secure message comprises a data message to besecurely stored, and securely processing comprises separately protectingand storing each of said two or more separate messages.
 41. The methodof claim 30 wherein said second party is an authentication server andsaid authentication server responds to a received request for accessbeing accepted by: generating an authentication code; splitting up saidauthentication code into two or more parts; separately encrypting saidtwo or more parts; and transmitting said two or more parts to separategateways who may forward the encrypted parts to the User so that it maybe re-assembled and decrypted.
 42. The method of claim 25 wherein saidsecure message comprises a data message being securely store at saidfirst party, said first party being a storage server, and said secondparty being a User retrieving said stored message.
 43. A method ofauthentication comprising: generating identification data for a User;dividing said identification data into two or more separate sets;protecting each of said two or more separate sets; and transmitting eachof said two or more separate protected sets of data to two or moreintermediate servers; said two or more intermediate servers: receiving apartial set of data from an authentication server; comparing the two ormore separate protects sets of data to the partial set of data;generating a pass code responsive to the comparison; and forwarding saidtwo or more separate protected sets of data and the pass code to theauthentication server; said authentication server re-assembling two ormore separate protected sets of data and determining whether accessshould be granted to said User.
 44. A system for secured communicationcomprising: a first device operable to: split a secure message into twoor more separate messages, each separate message including at least someunique portion of said secure data message, and said two or moreseparate messages collectively preserving information contained in saidsecure message; and transmit each of said two or more separate messagesto a separate gatekeeper; each of said separate gatekeepers beingoperable to: receive a respective one of said separate messages; receivea partial data set from a second device; securely process the one ofsaid separate messages by comparing the one of said separate messages tothe partial data set; generate a pass code responsive to the comparison;and transmit said processed separate message and the pass code to thesecond device; said second device being operable to: receive saidprocessed separate messages and the pass code from each of said separategatekeepers; and re-assemble said processed, separate messages; saidfirst device, second device and separate gatekeepers beinginterconnected via a communication network.